{"Publisher":"Microsoft-Windows-Audit","EventIDs":[1001,1002,2001,2002,2003,2004]}